syzbot


malloc: free list modified: free (2)

Status: auto-closed as invalid on 2022/07/27 14:00
Reported-by: syzbot+6b45863a004814b61fa9@syzkaller.appspotmail.com
First crash: 959d, last: 959d
Similar bugs (3)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd malloc: free list modified: free (3) 1 859d 859d 0/3 auto-obsoleted due to no activity on 2022/11/04 09:24
openbsd malloc: free list modified: free (4) C 17 22d 518d 0/3 upstream: reported C repro on 2023/07/13 09:12
openbsd malloc: free list modified: free 12 1658d 1880d 0/3 auto-closed as invalid on 2020/08/26 21:45

Sample crash report:
panic: Data modified on freelist: word 4 of object 0xffff800001016800 size 0x400 previous type free (0x0 != 0xdead4110)

Starting stack trace...
panic(ffffffff82562c73) at panic+0x155 sys/kern/subr_prf.c:233
malloc(400,7f,1) at malloc+0xa85 sys/kern/kern_malloc.c:364
parsepledges(ffff80002166aa90,ffffffff8255dc27,20000000,ffff80002e58dc38) at parsepledges+0x47 sys/kern/kern_pledge.c:429
sys_pledge(ffff80002166aa90,ffff80002e58dca8,ffff80002e58dd00) at sys_pledge+0x4d sys/kern/kern_pledge.c:470
syscall(ffff80002e58dd70) at syscall+0x44e sys/arch/amd64/amd64/trap.c:585
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xf38281adfe0, count: 251
End of stack trace.
syncing disks...panic: ffs_update: bad link cnt
Starting stack trace...
panic(ffffffff825ff7a8) at panic+0x155 sys/kern/subr_prf.c:233
ffs_update(fffffd8065f97d28,0) at ffs_update+0x303 sys/ufs/ffs/ffs_inode.c:101
VOP_FSYNC(fffffd807baa75d0,fffffd807f7d7540,2,ffff80002166aa90) at VOP_FSYNC+0xc5 sys/kern/vfs_vops.c:327
ffs_sync_vnode(fffffd807baa75d0,ffff80002e58d810) at ffs_sync_vnode+0x15a sys/ufs/ffs/ffs_vfsops.c:1191
vfs_mount_foreach_vnode(ffff8000006d8000,ffffffff810705b0,ffff80002e58d810) at vfs_mount_foreach_vnode+0x55 sys/kern/vfs_subr.c:894
ffs_sync(ffff8000006d8000,2,0,fffffd807f7d7540,ffff80002166aa90) at ffs_sync+0x11f sys/ufs/ffs/ffs_vfsops.c:1242
sys_sync(ffff80002166aa90,0,0) at sys_sync+0xbc sys/kern/vfs_syscalls.c:539
vfs_syncwait(ffff80002166aa90,1) at vfs_syncwait+0x36
vfs_shutdown(ffff80002166aa90) at vfs_shutdown+0x5d sys/kern/vfs_subr.c:1770
boot(100) at boot+0xbb sys/arch/amd64/amd64/machdep.c:830
reboot(100) at reboot+0x77
panic(ffffffff82562c73) at panic+0x175 sys/kern/subr_prf.c:235
malloc(400,7f,1) at malloc+0xa85 sys/kern/kern_malloc.c:364
parsepledges(ffff80002166aa90,ffffffff8255dc27,20000000,ffff80002e58dc38) at parsepledges+0x47 sys/kern/kern_pledge.c:429
sys_pledge(ffff80002166aa90,ffff80002e58dca8,ffff80002e58dd00) at sys_pledge+0x4d sys/kern/kern_pledge.c:470
syscall(ffff80002e58dd70) at syscall+0x44e sys/arch/amd64/amd64/trap.c:585
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xf38281adfe0, count: 240
End of stack trace.

dump to dev 4,1 not possible
rebooting...
SeaBIOS (version 1.8.2-google)
Total RAM Size = 0x0000000080000000 = 2048 MiB
CPUs found: 2     Max CPUs supported: 2
SeaBIOS (version 1.8.2-google)
Machine UUID db0dc653-7a57-7afa-fd77-d87c02d918a4
found virtio-scsi at 0:3
virtio-scsi vendor='Google' product='PersistentDisk' rev='1' type=0 removable=0
virtio-scsi blksize=512 sectors=4194304 = 2048 MiB
drive 0x000f2730: PCHS=0/0/0 translation=lba LCHS=520/128/63 s=4194304
Sending Seabios boot VM event.
Booting from Hard Disk 0...
>> OpenBSD/amd64 BOOT 3.53
boot> set $lines = 0
set: syntax error
boot> set $maxwidth = 0
set: syntax error
boot> show panic
boot: illegal argument panic
boot> trace
boot> show registers
boot> show proc
boot> ps
boot> show all locks
boot> show malloc
boot> show all pools
boot> machine ddbcpu 0
machine: syntax error
boot> trace
boot> machine ddbcpu 1
machine: syntax error
boot> trace

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2022/04/28 13:59 openbsd 259734c7096b 8a1f1f07 .config console log report ci-openbsd-main malloc: free list modified: free
* Struck through repros no longer work on HEAD.